Bitnami MariaDB Galera EUVD-2026-37931

Exploitation requires network reachability to the MariaDB service port (default 3306) on a deployment running an affected Bitnami MariaDB Galera container image or Helm chart. The vulnerable condition is present whenever the MARIADB_REPLICATION_USER and MARIADB_REPLICATION_PASSWORD environment variables have not been explicitly overridden from their defaults of monitor/monitor - this is the default state for all Helm chart deployments prior to 18.3.0, since the chart provided no Helm values to configure these credentials. Exploitation is limited by network exposure: if the MariaDB Service is of type ClusterIP (internal only) and Kubernetes NetworkPolicies restrict cross-namespace database access, exploitation is confined to workloads already running within the same cluster with reachable pod or service IPs. REPLICATION CLIENT privileges do not grant SELECT or other DML access, so an attacker cannot directly read application table data through this credential alone - the direct impact is constrained to replication metadata and topology enumeration.

The NVD-assigned CVSS 3.1 score of 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N correctly captures the low-complexity, network-accessible nature of the flaw and accurately limits impact to low confidentiality (REPLICATION CLIENT yields replication metadata, not table data). PR:N is technically justified because the hardcoded credential is publicly known, removing any practical authentication barrier. EPSS data was not provided in the input, so exploitation probability cannot be independently assessed from that signal. The vulnerability does not appear in CISA KEV and no POC code is publicly known, suggesting no current widespread weaponization. However, raw CVSS undersells the structural risk for Helm-based deployments: the chart's architectural omission of override parameters meant there was no supported path to harden the credential, making the flaw endemic to every standard deployment prior to 18.3.0 rather than an operator misconfiguration. In Kubernetes environments where database ports are accessible across namespaces or from compromised workloads, the hardcoded credential enables low-effort replication topology reconnaissance that can inform further targeted database attacks. The flaw is best characterized as moderate severity with elevated deployment breadth.

An attacker with network access to a Kubernetes cluster running an unpatched Bitnami MariaDB Galera deployment connects to port 3306 on any cluster node using the publicly documented credentials monitor/monitor, requiring only a standard MySQL client. Once authenticated as the replication user, they execute SHOW SLAVE STATUS, SHOW MASTER STATUS, and SHOW BINARY LOGS to map the cluster's replication topology, identify the primary write node, and determine binary log positions - information useful for planning targeted follow-on attacks such as targeted disruption of the primary or timing-based data extraction attempts. No exploit code is publicly known; the attack requires only knowledge of the default credentials published in the CVE description.